Software updates and the security window

The security window

An update closes some known problems; it does not make a device permanently secure. The useful question is whether a device is receiving fixes in time for the threats that matter to you. A device that no longer receives security updates belongs in a different threat model from a current device.

Enable automatic updates where they are reliable and compatible with your work. If updates must be managed manually, choose a regular schedule and check the operating system, browser, firmware, applications and extensions separately.

What to do when an update breaks something

Do not disable updates permanently because of one failure. Keep a tested backup, read the vendor’s release notes, and separate the affected device from sensitive work until a fix is available. A temporary delay can be reasonable; an indefinite delay turns a known vulnerability into a standing exposure.

Retire unsupported devices

If a phone, router, browser or operating system has reached end of support, replace it or isolate it from sensitive activity. Removing unused software and accounts reduces the attack surface but does not replace security patches.